# Security Guidance

> Anthropic's security review for Claude Code: flags injection, XSS, secrets and more as Claude edits, finishes a turn and commits.

Anthropic's security review plugin for Claude Code. It watches the code Claude writes and checks it in three layers, from instant warnings on each edit to a full review when you commit, and hands what it finds back to Claude to fix.

What it checks
- Pattern warnings: instant reminders when Claude edits or writes code with one of about 25 known-dangerous patterns, such as yaml.load, pickle.load on untrusted data, raw innerHTML or hardcoded secrets
- Diff review: when Claude finishes a turn, the plugin sends the diff to a Claude Opus model and feeds high-severity findings back, so Claude can fix them before you see its response
- Commit review: on git commit, an agentic reviewer reads related files to trace data flow across the codebase, catching multi-file problems that patterns miss, such as IDOR, auth bypass and cross-file SSRF
Findings cover injection, XSS, SSRF, hardcoded secrets, IDOR, auth bypass, unsafe deserialization, path traversal and more.

Make it your own
- Add your team's rules in a claude-security-guidance.md file (user-wide in ~/.claude, or per project in .claude/), and the diff review follows them
- Choose the review model with SECURITY_REVIEW_MODEL, or turn any layer off with an environment variable
- To silence one finding, add a comment on the line saying why it's safe

How to install it
In Claude Code, run /plugin marketplace add anthropics/claude-code, then /plugin install security-guidance@claude-code-plugins. Anthropic also ships it in its official marketplace, which Claude Code has on by default: /plugin install security-guidance@claude-plugins-official. It needs Claude Code 2.1.144 or later and Python 3.8 or later.

Good to know
- The diff and commit reviews send the changed code to your model endpoint: Anthropic's API by default, or your gateway or cloud provider.
- Anthropic calls it a best-effort aid, not a replacement for human code review, SAST/DAST, dependency scanning or pen-testing.
- It keeps a local debug log at ~/.claude/security/log.txt. Nothing in it is uploaded.

- Type: Plugin
- Made by: Anthropic
- Category: Security
- Formats: Claude plugins
- Version: 2.0.0
- Source: https://github.com/anthropics/claude-code/tree/HEAD/plugins/security-guidance
- Page: https://pluginboard.ai/plugins/anthropic-security-guidance

## Works with

- Claude
- GitHub Copilot
- Claude Code
- OpenClaw

## Install

### Claude

In Claude (web or desktop): Customize → Plugins → Add → Add marketplace, enter anthropics/claude-code, then add security-guidance

### Claude Code

In Claude Code:

```text
/plugin marketplace add anthropics/claude-code
/plugin install security-guidance@claude-code-plugins
```

---
From Pluginboard (https://pluginboard.ai).